California Consumer Privacy Act of 2018.

(1) Existing law, the California Consumer Privacy Act of 2018 (CCPA) , grants a consumer various rights with regard to personal information relating to that consumer collected by a business, including the right to know the categories and the specific pieces of personal information that have been collected and to opt out of the sale of personal information. The act also grants a consumer the right to request a business to delete any personal information about the consumer collected by the business and requires a business to do so upon receipt of a verified request, except as specified. The act excepts certain categories of personal information and entities from its provisions, including medical information, as specified. This bill would except from the CCPA information that was deidentified in accordance with specified federal law, or was derived from medical information, protected health information, individually identifiable health information, or identifiable private information, consistent with specified federal policy, as provided. The bill also would except from the CCPA a business associate of a covered entity, as defined, that is governed by federal privacy, security, and data breach notification rules if the business associate maintains, uses, and discloses patient information in accordance with specified requirements. The bill would further except information that is collected for, used in, or disclosed in research, as defined. The bill would define terms for these purposes. This bill would additionally prohibit a business or other person from reidentifying information that was deidentified, unless a specified exception is met. The bill would, beginning January 1, 2021, require a contract for the sale or license of deidentified information to include specified provisions relating to the prohibition of reidentification, as provided. (2) The CCPA requires a business to make certain disclosures to consumers, in a specified form, in its online privacy policy, if the business has an online privacy policy, and in any California-specific description of consumers' privacy rights, or, if the business does not maintain an online privacy policy or policies, on its internet website, and to update that information at least once every 12 months. This bill would require a business that sells or discloses information that was deidentified in accordance with specified federal law, was derived from protected health information, individually identifiable health information, or identifiable private information to also disclose whether the business sells or discloses deidentified patient information derived from patient information and, if so, whether that information was deidentified pursuant to specified methods. (3) This bill would declare that it is to take effect immediately as an urgency statute.